Only process CD flags in a dnssec mode

diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc
index 33ef3437a80bf7c162aba1db664e2a5782b4c7da..9d6617190e7a38af872742b08ccc123155b07e0f 100644 (file)
--- a/pdns/pdns_recursor.cc
+++ b/pdns/pdns_recursor.cc
@@ -736,12 +736,17 @@ void startDoResolve(void *p)
       sr.d_requestor=dc->d_remote;
     }
 
-    if(g_dnssecmode != DNSSECMode::Off)
+    if(g_dnssecmode != DNSSECMode::Off) {
       sr.d_doDNSSEC=true;
-    
-    if(pw.getHeader()->cd || (edo.d_Z & EDNSOpts::DNSSECOK)) {
-      DNSSECOK=true;
-      g_stats.dnssecQueries++;
+
+      // Does the requestor want DNSSEC records?
+      if(edo.d_Z & EDNSOpts::DNSSECOK) {
+        DNSSECOK=true;
+        g_stats.dnssecQueries++;
+      }
+    } else {
+      // Ignore the client-set CD flag
+      pw.getHeader()->cd=0;
     }
 
     bool tracedQuery=false; // we could consider letting Lua know about this too